ICMP Mystery!!

[alpana.nath]

Hello,

I am bit confused about ICMP, that does ICMP use UDP on Layer 4 for its transport or not???

Please help.

[ankurbhasin]

Hi Alpana,

ICMP (ping, trace)is a layer 3 protocol suite within the TCP/IP suite, doesnt test any layer 4 or above functions, therefore, it has no TCP/UDP layer 4 port number.

HTH

Ankur

[mehrdad]

as Ankur said, it's layer 3 see the following image link as well:

http://www.microsoft.com/technet/images/archive/winntas/maintain/images/tcpip01.gif

Mehrdad

[Kevin Dorrell]

But I think ICMP runs over IP, doesn't it? It is protocol number 1. (ICMP=1, IGMP=2, TCP=6, UDP=17, etc.). Now, IP is a layer-3 protocol because it is host-to-host. Therefore you could argue that ICMP is layer-4, and it is used to transport control plane information between layer-3 entities.

So I'm not to happy about the diagram, because it doesn't show ICMP running over IP, which it does.

Kevin Dorrell

Luxembourg

[mehrdad]

Hi Kevin,

In my opinion icmp can't be a layer 3 absolutely because as you said ip knows it as upper layer, it can't be a layer 4 as well because it's just data control but we can called it as layer 3+ not 4 and not 3

Regards,

Mehrdad Arshad Rad

[Kevin Dorrell]

Yes, that sounds fair enough. It doesn't actually transport anything, so its difficult to shoehorn it into the transport layer. I'll settle for 3+, or 3 control-plane.

Kevin Dorrell

Luxembourg

[jaregalado]

Hi

Nice arguments, I remember the Dogulas E. Comer TCP/IP Book (which I read some time ago) classified ICMP strictly as part of IP (sort of IP control plane) and in fact the box representing ICMP on the OSI stack was inside the IP Box.

Regards.

[michael_davis]

Just think of icmp as the "messaging" component of L3. It's used to facilitate L3 functions and report L3 conditions ie report reachability, of L3 network, hosts, routes, TTL, etc, to L3 endpoints. All of these are L3 functions, and as such icmp is L3 itself.

Also, wrt to the "over IP" argument (and no disrespect intended); using that logic, you *could* argue that TCP/IP is a L2 or L1 protocol because all of it is carried over a L2 frame or L1 media! ;-)

[aburow]

Some history:

- IPv4 was documented in 1974 after approx 14 years in development.

- OSI 7 Layer Model was published in 1984 in order to provide a common reference for government contracts.

OSI does not fit perfectly into the world of TCP/IP but it is pretty close. :)

There are a couple of sites on the internet that go into the history of both tcp/ip and the osi 7 layer model.

The OSI model is used in order create layers of abstraction for development and interoperability.

[cisco_trouble]

I agree that its more a L3 protocol than L4, but it mimics a TCP whereby its it sent with IP to get an acknowledgement...

[Michael Stuckey]

I think this conversation is very interesting.

Just so everyone knows, there is an aplication out there called ping(Not the one everyone uses) which uses UDP for testing also used by hackers. This might be where the confusion comes into play.

The purpose of ICMP(RFC 792) is to send messages especially error messages for all protocols above it. If it resided on a higher level it would not be able to report problems for the lower levels.

Your vote is appreciated!

[michael_davis]

I agree, this is a fun debate/thread. But I disagree with the assertion that ICMP handles messages for upper layer protocols.

As I said earlier, I read RFC 792 to confirm that ICMP is a IP layer protocol. OSI Layer 3 is the nearest equivalent to DoD IP layer.

It does not send application nor Host-to-Host/L4 messages, only messages pertaining to datagram handling.

From the Introduction in RFC792:

"ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module."

Further:

"The Internet Protocol is not designed to be absolutely reliable. The purpose of these control messages is to provide feedback about problems in the communication environment, not to make IP reliable.

There are still no guarantees that a datagram will be delivered or a control message will be returned. Some datagrams may still be undelivered without any report of their loss. The higher level protocols that use IP must implement their own reliability procedures if reliable communication is required."

More complete text for your reading pleasure can be found at:

http://www.faqs.org/rfcs/rfc792.html